IopInitializeCrashDump
UINT8 __stdcall IopInitializeCrashDump(VOID *hPageFile, _UNICODE_STRING *PagingFileName){
VOID *v4;
INT64 v5;
INT64 v7[2];
__int64 v8[3];
int v9;
int v10;
char v11;
int v12;
__int16 v13;
char v14;
UINT64 dumpSetting;
LODWORD(dumpSetting) = 0;
v7[0] = 0i64;
LODWORD(v7[1]) = 0;
if( !*(&stru_140CF2E80 + 4800) )
{
IopReadDumpRegistry((UINT64 *)hPageFile, (UINT64)&dumpSetting);
if( qword_140C50968 && qword_140C50960 && byte_140C50958 || !(_DWORD)dumpSetting )
return 1;
if( (qword_140C50968 || IopLoadCrashdumpDriver() >= 0) && SecureDump_GetSecureDumpSettings((INT64)v7) >= 0 )
{
if( !LOBYTE(v7[0]) )
goto LABEL_9;
if( qword_140C50A08 )
{
v9 = HIDWORD(v7[0]);
v10 = v7[1];
v11 = BYTE1(v7[0]);
v8[1] = (__int64)SecureDump_Get_SecureDumpHeader;
v8[2] = (__int64)SecureDump_Encrypt_DmpData;
v8[0] = 40i64;
v12 = 0;
v13 = 0;
v14 = 0;
if( (int)qword_140C50A08(v8) >= 0 )
{
LABEL_9:
*(_UNICODE_STRING *)v7 = *PagingFileName;
if( (int)((__int64(__fastcall *)(VOID *, _QWORD *, INT64 *))qword_140C509A8)(
hPageFile,
&qword_140C50960,
v7) >= 0 )
{
byte_140C50958 = 1;
v4 = *(VOID **)(qword_140C50960 + 1352i64);
if( !v4 )
{
if( !hPageFile )
return 1;
v4 = hPageFile;
}
dumpSetting = 0i64;
if( ObReferenceObjectByHandle(v4, 0i64, (_OBJECT_TYPE *)IoFileObjectType, 0, (VOID **)&dumpSetting, 0i64) >= 0 )
{
FsRtlIssueFileNotificationFsctl(
(_FILE_OBJECT *)dumpSetting,
v5,
(INT128 *)&FILE_TYPE_NOTIFICATION_GUID_CRASHDUMP_FILE);
HalPutDmaAdapter((PADAPTER_OBJECT)dumpSetting);
}
return 1;
}
qword_140C50960 = 0i64;
}
}
}
}
return 0;
}Referenced by:
IoConfigureCrashDump
IoInitializeCrashDump
IopInitCrashDumpRegCallback